agenttesla | 17fa46d3951bb6480a8a807e413aa93bb8d7a235b40f4bade542e72a32acf6ca | Triage

Sharing

General

Target

RFQ678903_-INQUIRY_THANHPHUON_INDUSTRIA_TRADING.exe
Size

1.2MB
Sample

241014-msqq7stekb
MD5

38599452de2095f605b692a8aba0b457
SHA1

21f02b940d3e416a57e2eef4844fc91159f85651
SHA256

17fa46d3951bb6480a8a807e413aa93bb8d7a235b40f4bade542e72a32acf6ca
SHA512

ef1c9ce4c3da0cb5064951386576d2e8d7d9cb31e7dae9972ac3df89282a7c7b4bcdf4e9a8238df85cd50eb6372a23486fac256339f10d1cbd9850da9083232d
SSDEEP

24576:yq6zrF8bk5g4xYBdDZj6wxWqLeN/xoaY/scfXCzF:azrF4k5zY5Eh/x1YjfXCJ

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.zoho.eu
Port:
587
Username:
[email protected]
Password:
office12#

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.zoho.eu
Port:
587
Username:
[email protected]
Password:
office12#
Email To:
[email protected]

Targets

- Target
  
  RFQ678903_-INQUIRY_THANHPHUON_INDUSTRIA_TRADING.exe
- Size
  
  1.2MB
- MD5
  
  38599452de2095f605b692a8aba0b457
- SHA1
  
  21f02b940d3e416a57e2eef4844fc91159f85651
- SHA256
  
  17fa46d3951bb6480a8a807e413aa93bb8d7a235b40f4bade542e72a32acf6ca
- SHA512
  
  ef1c9ce4c3da0cb5064951386576d2e8d7d9cb31e7dae9972ac3df89282a7c7b4bcdf4e9a8238df85cd50eb6372a23486fac256339f10d1cbd9850da9083232d
- SSDEEP
  
  24576:yq6zrF8bk5g4xYBdDZj6wxWqLeN/xoaY/scfXCzF:azrF4k5zY5Eh/x1YjfXCJ
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Remote System Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan